Privacy notice

Who is responsible

PWK Holdings Pte. Ltd. owns and operates DocSpotCheck. This notice covers website visitors, account holders and personal data in submitted documents. PWK handles account and service administration data for its own purposes. Where we process evidence on behalf of an organisation, that organisation remains responsible for its authority and instructions; a separate data processing agreement may be needed.

Email info@pwkholdings.com or write to PWK Holdings Pte. Ltd., Midview City, 22 Sin Ming Lane, #06-76, Singapore 573969. For privacy matters, mark your message “Attention: Data Protection Officer”.

Information we handle

Account details include your email address, authentication records and information you provide when contacting us. Submitted material can include filenames, original documents, images, extracted text and figures, document metadata, checksums, page previews, reports, folders and review acknowledgements. Evidence may contain information about people other than the account holder.

Technical and security records may include IP addresses, browser and device information, request times, errors and operational logs. During approved testing, analysis workspaces and diagnostic artifacts may also contain document-derived information. Do not include unnecessary personal data in uploads or support messages.

Why we use it

We use information to authenticate users, process requested checks, show evidence and reports, save and organise files, respond to requests, investigate errors and abuse, protect accounts and meet legal obligations. We do not sell uploaded evidence. We do not use uploaded evidence to train a DocSpotCheck model.

We collect, use and disclose personal data with the necessary consent, on your organisation’s authorised instructions, or as otherwise permitted or required by applicable law. Do not upload third-party information unless you have the necessary authority and have provided any required notices.

Service providers and AI processing

DocSpotCheck is hosted on Vercel and uses Supabase for authentication, database records and private file storage. In approved hosted testing, files are inspected in temporary Vercel Sandbox environments. Relevant document content, page images, extracted text and tool results can pass through Vercel AI Gateway to OpenAI for automated analysis. Local development testing can use a separately authenticated OpenAI-backed runner with different provider settings. Customer document checking remains closed.

Approved sandbox checkout uses Stripe to handle test customer and billing details. Real payments are not enabled. Do not enter real payment-card data in the sandbox.

When you submit a Case Review enquiry, your contact details and form information are sent through Resend to the DocSpotCheck enquiry mailbox so we can assess and respond to your request. The email provider and our mailbox can retain message content and delivery records. Do not include confidential evidence or personal data about others. Enquiries are not added to a marketing mailing list.

Hosted AI requests through our server require provider routes supporting Zero Data Retention and excluding prompt training. We also request that responses are not stored for later API retrieval. These AI routing controls are not a platform-wide zero-retention guarantee: saved files, operational records and enquiry emails have their own retention. Provider safety, caching and other contractual exceptions may apply. Before submitting sensitive evidence, ask us to confirm the applicable processing arrangement and contractual controls. Customer analysis remains unavailable while those launch requirements are reviewed.

We may disclose information to providers supporting the service, advisers where necessary, and authorities when legally required. Access should be limited to the purposes described here. Provider or processing changes that materially affect users will be reflected in this notice.

Processing locations

Application functions, hosted analysis environments and the primary database are configured in Singapore. This does not establish Singapore-only processing: AI inference, email, payments, content delivery, logs and other provider operations may involve other countries. We do not offer a Singapore-only data residency guarantee. Transfers must have safeguards required by applicable law, including comparable protection where required by Singapore’s Personal Data Protection Act 2012 (PDPA). Contact us before uploading material subject to geographic or contractual restrictions.

Retention and deletion

Saved originals, previews, reports and review states remain in your account until you delete them or request account closure, subject to applicable retention requirements. The current testing environment applies a 1 GB account storage limit; this is not a paid-plan entitlement. Temporary browser selections and upload-batch overviews may disappear when the tab is refreshed or closed.

Hosted testing uploads use a private staging area and upload links valid for two hours. Cleanup is scheduled after those links expire; processing or cleanup failures can delay removal. Temporary analysis environments are stopped after processing, cancellation or a time limit. We do not create runtime snapshots from environments that have received evidence.

Deleting a saved file removes its original, retained previews and saved checking versions from active application storage. A failed deletion is shown so you can retry. Deleting a folder removes the folder structure and moves remaining files to Unfiled; it does not delete those files.

Deleting a saved file does not automatically erase enquiry emails, processing-job metadata, page-usage records, billing records or security logs. Deletion from active storage also does not guarantee immediate erasure from provider backups or other retained artifacts. Limited records may need to be retained for legal, security or dispute purposes. Contact us to request broader deletion or account closure and information about applicable retention. We cease retaining identifiable data when its purpose is no longer served and retention is no longer necessary for legal or business purposes.

Cookies and browser storage

Necessary authentication cookies keep you signed in. Browser session storage can retain navigation and review-interface state; selected file previews also use temporary browser URLs and memory. Blocking necessary cookies can prevent sign-in. This notice does not treat necessary service cookies as consent to advertising or unrelated marketing. Any future non-essential tracking requires a separate assessment and appropriate notice or consent.

Protection and incidents

Saved evidence uses private storage and account-scoped access checks. These measures reduce risk but cannot guarantee absolute security. Authorised operational access may be necessary to support or secure the service. No certification, independent security audit, guaranteed recovery time or uninterrupted availability is represented on this site.

If a personal data incident occurs, we will assess it, take appropriate remedial steps and notify regulators and affected individuals where required by applicable law. Report suspected exposure promptly, without attaching confidential evidence to an ordinary email.

Your requests and choices

Contact us to ask about our practices, request access to or correction of personal data, withdraw consent where applicable, or request deletion and account closure. We may verify your identity and authority before acting. Legal exceptions can apply, and withdrawing consent may prevent us from providing parts of the service. We will explain material consequences and any lawful refusal or applicable fee before proceeding.

If the information was submitted by your employer, adviser or another organisation, we may need to refer your request to that organisation or act on its instructions. You may also raise concerns with Singapore’s Personal Data Protection Commission. We will update this notice as the service develops and provide further notice of material changes where appropriate.